How to Enable or Disable Password Expiration in Windows 11

Why Password Expiration Matters

Windows 11 password expiration is a security feature that prompts users to change credentials on a regular schedule. Active enforcement protects accounts by limiting the window of exposure if current credentials become compromised. Local user profiles enforce expiration after a designated period, typically fixed at 42 days by default.

Maximum password age dictates how many days pass before Windows requires a reset, while minimum password age defines how long a password must remain in use before modification. Local accounts default to a maximum age of 42 days and a minimum age of 0 days.

Microsoft accounts enforce a default expiration cycle of 72 days.

Option One

Enable or Disable Password Expiration for Local Account in Local Users and Groups

Open the Local Users and Groups manager (lusrmgr.msc) by pressing Win+R, typing lusrmgr.msc, and hitting Enter to manage local credentials. Availability is restricted to Pro, Enterprise, and Education editions of the operating system. Modifying user properties through this interface tailors security policies to specific workflows.

1. Open Local Users and Groups (lusrmgr.msc).
2. Do the following:

   • Click on the Users folder in the left panel.
   • Double-click on the local account name you want to change in the middle panel.
3. In the General tab, check (to disable - this is the default) or uncheck (to enable) Password never expires for what you want. Then click OK.
   

   Note: The Password never expires option will be grayed out if the User must change password at next logon box is checked.

4. If you want, you can also change the maximum and minimum password age for local accounts.
5. You can now close Local Users and Groups if you want.

Option Two

Enable or Disable Password Expiration for Local Account in Command Prompt

⚠️ Requires admin privileges

1. Open Windows Terminal (Admin), and select Command Prompt.

Enable Password Expiration for Local Account(s)

Enforce expiration rules using the command-line interface to mandate scheduled updates for local profiles. Executing the required command tells Windows that credentials must rotate following a defined interval. Apply this policy across all profiles by running the `wmic UserAccount set PasswordExpires=True` command.

2. Type one of the commands below into the command prompt and press Enter:
   

   For all existing local accounts:

   
   

   wmic UserAccount set PasswordExpires=True

   
   

   OR

   
   

   For a specific local account:

   
   

   wmic UserAccount where Name="adminuser" set PasswordExpires=True

   
   

   Replace adminuser with the actual username of the local account you want to enable password expiration for.

3. If you want, you can also change the maximum and minimum password age for local accounts.

Disable Password Expiration for Local Account(s)

Prevent a local account password from expiring by running a command-line utility. This keeps unattended systems accessible without forcing recurring credential updates.

Disabling the expiration timer stops the operating system from demanding scheduled security updates. Unattended workstations and shared environments often utilize this configuration to maintain uninterrupted operational access.

2. Type one of the commands below into the command prompt and press Enter:
   

   For all existing local accounts:

   
   

   wmic UserAccount set PasswordExpires=False

   
   

   OR

   
   

   For a specific local account:

   
   

   wmic UserAccount where Name="adminuser" set PasswordExpires=False

   
   

   Replace adminuser with the actual username of the local account you want to disable password expiration for.

3. You can now close Windows Terminal (Admin) if you want.

Option Three

Enable or Disable Password Expiration for Local Account in PowerShell

⚠️ Requires admin privileges

1. Open Windows Terminal (Admin), and select Windows PowerShell.

Enable Password Expiration for Local Account(s)

What happens: Credentials require modification once the designated expiration window closes.

2. Type one of the commands below into the command prompt and press Enter:
   

   For all existing local accounts:

   
   

   Get-LocalUser | Set-LocalUser -PasswordNeverExpires $false

   
   

   OR

   
   

   For a specific local account:

   
   

   Set-LocalUser -Name 'adminuser' -PasswordNeverExpires $false

   
   

   Replace adminuser with the actual username of the local account you want to enable password expiration for.

3. If you want, you can also change the maximum and minimum password age for local accounts.
4. When finished, go to step 5 below.

Disable Password Expiration for Local Account(s)

Disabling expiration controls halts automated prompts for credential changes. Removing these renewal prompts maintains continuous uptime for automated tasks and server endpoints.

2. Type one of the commands below into the command prompt and press Enter:
   

   For all existing local accounts:

   
   

   Get-LocalUser | Set-LocalUser -PasswordNeverExpires $true

   
   

   OR

   
   

   For a specific local account:

   
   

   Set-LocalUser -Name 'adminuser' -PasswordNeverExpires $true

   
   

   Replace adminuser with the actual username of the local account you want to disable password expiration for.

3. You can now close Windows Terminal (Admin) if you want.

Option Four

Enable or Disable Password Expiration for Microsoft Account Online at Microsoft

Managing Microsoft account credentials requires navigating to the official online profile portal. Account security policies update directly through the browser dashboard after completing identity verification.

1. Go to the Change your password site at Microsoft for your Microsoft account.
2. Sign in to the Microsoft site with your Microsoft account to verify.
3. Do the following:

   • Type your current password.
   • Type a new password.
   • Reenter the password to confirm.
   • Check (to enable) or uncheck (to disable - this is the default) Make me change my password every 72 days for what you want.
   • Click Save.
4. Sign in to the Microsoft site with your Microsoft account's new password to verify.
   

Summary

Local user configurations utilize management utilities, command-line tools, or PowerShell scripts, while cloud profiles require web-based dashboard portals. Selecting the Local Users and Groups utility provides an accessible graphical workflow for supported Windows editions.

• Option One: Use Local Users and Groups (easiest for beginners, Pro/Enterprise/Education editions only)
• Option Two: Use Command Prompt with WMIC commands (works on all editions)
• Option Three: Use PowerShell commands (works on all editions)
• Option Four: Change settings online for your Microsoft account

Mandatory credential rotation enforces baseline security compliance across Windows installations. Administrators retain the flexibility to override these restrictions when operational needs dictate continuous uptime. Administrative permissions remain mandatory for all system-level configuration adjustments.